# OT Intel API – NERC CIP & IEC 62443 Compliance Gap Mapping

> OT Intel API – NERC CIP & IEC 62443 Compliance Gap Mapping is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-14).

Maps a CVE or ICS threat actor to specific NERC CIP and IEC 62443 compliance control gaps, returning compliance status, required actions, and compensating controls for OT/ICS environments.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/compliance
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-nerc-cip-iec-62443-compliance-gap-mapping-3dcc1c01
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bVcryEk80ONtwu_dc38wE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-nerc-cip-iec-62443-compliance-gap-mapping-3dcc1c01
```

Example prompt: What NERC CIP and IEC 62443 compliance gaps does CVE-2023-38802 create in my OT environment, and what compensating controls should I apply while the patch is pending?

## When to prefer this

Use this endpoint when you need to translate a specific ICS/OT vulnerability (CVE) or threat actor into actionable regulatory compliance obligations under NERC CIP or IEC 62443 — especially for industrial SOC teams preparing audit evidence, compensating control justifications, or patch prioritization tied to regulatory deadlines. Prefer over generic vulnerability databases when OT-adjusted severity, cyber-physical impact context, and specific CIP control references are needed.

## Known failure modes

- Missing required cve_id parameter returns 400 validation error
- Unknown or malformed CVE ID may return empty controls list with no match
- Invalid framework filter value (not nerc_cip, iec_62443, or all) may return error or default to all
- Service hosted on Render free tier may experience cold-start latency or downtime
- Payment failure via x402/USDC micropayment blocks access with 402 response
- Obscure or newly published CVEs may lack OT-specific compliance mappings in the database

## How this service works

Compliance gap mapping for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443, NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, UAE NESA IA. Pass ?cve_id=CVE-2023-38802 or ?actor=SANDWORM, optionally &framework=<value> to filter. Returns triggered controls (e.g. CIP-007-6 R2, IEC 62443-3-3 SR 5.1), status (NON_COMPLIANT_IF_UNMITIGATED / REVIEW_REQUIRED), required action, and compensating controls. For automated compliance reporting agents on cron.

## Output

Returns a structured compliance gap report keyed to the CVE or threat actor, including: per-framework control listings (NERC CIP CIP-007-6 R2, IEC 62443 SR references) with status (NON_COMPLIANT_IF_UNMITIGATED), action required text, compensating control recommendations, a priority action summary, count of controls triggered, data sources used, and a freshness timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "actor": {
       "type": "string",
       "description": "Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME — triggers actor-specific control mappings. At least one of cve_id or actor is required."
      },
      "cve_id": {
       "type": "string",
       "description": "CVE identifier e.g. CVE-2023-38802 — triggers CVE-specific control mappings. At least one of cve_id or actor is required."
      },
      "framework": {
       "type": "string",
       "description": "Optional filter to one compliance framework. Valid values: nerc_cip, iec_62443_2_1, iec_62443_2_4, iec_62443_3_2, iec_62443_3_3, iec_62443_4_2, nist_800_82, nist_csf, cisa_cpg, nca_otcc, uae_nesa_ia. Omit (or pass 'all') to return matches across every framework."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "cve_id": "CVE-2023-38802",
  "query_id": "CVE-2023-38802",
  "freshness": "2026-06-19T10:00:00Z",
  "frameworks": {
   "nerc_cip": [
    {
     "title": "Security Patch Management",
     "status": "NON_COMPLIANT_IF_UNMITIGATED",
     "control": "CIP-007-6 R2",
     "action_required": "Evaluate CVE-2023-38802 within 35 days of CISA KEV listing.",
     "compensating_control": "Network segmentation restricting BGP traffic to SCADA DMZ pending patch."
    }
   ],
   "iec_62443_3_3": [
    {
     "status": "NON_COMPLIANT_IF_UNMITIGATED",
     "component": "3-3 SR 5.1",
     "requirement": "Network Segmentation",
     "compensating_control": "Enforce zone conduits: restrict BGP/ICS protocol traffic to whitelisted source/destination pairs."
    }
   ]
  },
  "data_sources": [
   "OT-Intel-DB-Compliance",
   "DeepSeek-CTI-Analysis"
  ],
  "priority_action": "Apply network segmentation at the ESP boundary immediately; schedule CVE patch for next maintenance window.",
  "controls_triggered": 2
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-nerc-cip-iec-62443-compliance-gap-mapping-3dcc1c01/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)